29 matches found
ralph
Ralph A working implementation of the Ralph Wiggum autonomous loop technique for Claude Code. Background The official ralph-wiggum plugin in Anthropic's plugin marketplace is currently broken due to a security update in Claude Code v1.0.20 August 2025. The security patch CVE-2025-54795 correctly...
CVE-2026-111683
Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/ and...
CVE-2026-111683 Allegro Ralph through 20260902.1 Missing Authorization in Data Center Rack API
Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/ and...
CVE-2026-111683 Allegro Ralph through 20260902.1 Missing Authorization in Data Center Rack API
Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/ and...
EUVD-2026-102974
Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/ and...
CVE-2026-111683
The Allegro Ralph application, through version 20260902.1 , is vulnerable to a missing authorization flaw (CWE-862) in its Data Center Rack API. The root cause is that RalphPermission skips permission checks for views that do not include a queryset. Authenticated staff users can exploit this by c...
CVE-2026-111683: Missing Authorization
Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/ and...
PT-2026-116082
Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/ and /api/serve...
CVE-2026-16211: Concurrent Execution using Shared Resource with Improper Synchronization
A vulnerability was determined in allegro up to bcf65b994ef29fb3fc2e10b660e6288723d5209e. This impacts the function AssetLastHostname.incrementhostname of the file src/ralph/assets/models/assets.py of the component Hostname Allocation Handler. Executing a manipulation of the argument counter can...
Mailpit code issue vulnerabilities
Mailpit is an email testing tool developed by Ralph Slooten personally. Versions of Mailpit prior to 1.28.3 had a code vulnerability. This vulnerability stemmed from the inlineRemoteCSS function in the HTML Check feature, which allowed external CSS files to be downloaded, potentially leading to...
Samba Spotlight mdssvc RPC Request Infinite
Description When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function slunpackloop did not validate a field in the network packet that contains the count of elements in an array-like structure. By passing 0 as the count value, the attacked function will run in ...
ralph-binder.de Cross Site Scripting vulnerability OBB-1328846
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Online-Exam-System 2015 - SQL Injection
Online-Exam-System 2015 suffers from a remote SQL injection vulnerability. Exploit Title: Online-Exam-System 2015 - 'feedback' SQL Injection Date: 2020-06-04 Exploit Author: Gus Ralph Vendor Homepage: https://github.com/sunnygkp10/ Software Link:...
Navigate CMS 2.8.7 - Cross-Site Request Forgery (Add Admin) Vulnerability
Exploit for php platform in category web applications Exploit Title: Navigate CMS 2.8.7 - Cross-Site Request Forgery Add Admin Exploit Author: Gus Ralph Vendor Homepage: https://www.navigatecms.com/en/home Software Link:...
Navigate CMS 2.8.7 - ''sidx' SQL Injection (Authenticated)
Exploit Title: Navigate CMS 2.8.7 - ''sidx' SQL Injection Authenticated Date: 2020-06-04 Exploit Author: Gus Ralph Vendor Homepage: https://www.navigatecms.com/en/home Software Link: https://sourceforge.net/projects/navigatecms/files/releases/navigate-2.8.7r1401.zip/download Version: 2.8.7 Tested...
Navigate CMS 2.8.7 - Authenticated Directory Traversal
Exploit Title: Navigate CMS 2.8.7 - Authenticated Directory Traversal Date: 2020-06-04 Exploit Author: Gus Ralph Vendor Homepage: https://www.navigatecms.com/en/home Software Link: https://sourceforge.net/projects/navigatecms/files/releases/navigate-2.8.7r1401.zip/download Version: 2.8.7 Tested o...
Ubuntu: Security Advisory (USN-3673-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
ralphlauren.com XSS vulnerability
Vulnerable URL: http://www.ralphlauren.com/transparencyact/index.jsp?ab='-confirmOPENBUGBOUNTY-' Details: Description| Value ---|--- Patched:| No Latest check for patch:| 30.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 4508 VIP website status:| Yes Check...
global.ralphlauren.com XSS vulnerability
Open Bug Bounty ID: OBB-198538 Description| Value ---|--- Affected Website:| global.ralphlauren.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...
Remote DoS in Samba (AD) LDAP server.
Description All versions of Samba from 4.0.0 to 4.1.21 inclusive are vulnerable to an anonymous memory exhaustion attack in the samba daemon LDAP server. A malicious client can send packets that cause the LDAP server provided by the AD DC in the samba daemon process to consume unlimited memory an...